fix(ci): prevent IPR check eviction

[bokelley]

Summary

• replace the repository-wide IPR concurrency lock with a per-PR queue
• preserve synchronize and signature events with GitHub Actions queue: max
• keep actionlint coverage while narrowly ignoring its pre-queue parser error

Why

GitHub's default concurrency behavior keeps only one pending run. The previous global group caused unrelated PR events to evict pending IPR runs before the check job started, so the required IPR Policy / Signature status was never published. Recent history showed 11 cancelled IPR runs among the latest 100, with sampled cancelled runs containing zero jobs.

Per-PR FIFO queues serialize status updates for the same PR while allowing unrelated PRs to proceed independently.

Validation

• actionlint v1.7.7 across all workflows, with the exact queue-key compatibility diagnostic ignored
• zizmor v1.29.0 at high severity/high confidence for the IPR workflow
• git diff --check
• repository pre-commit hooks
• independent GitHub Actions and workflow-security expert reviews

Follow-ups

• strengthen central ledger conflict recovery for simultaneous first-time signers on different PRs
• optionally reject non-author signature comments before they enter the per-PR queue

---

Open workspace in Conductor

[aao-secretariat]

Ladon verdict: Approve

Approve — CI workflow fix, no blocking or medium findings.

This PR replaces a repo-wide IPR concurrency group (which was evicting pending runs and leaving the required IPR Policy / Signature status unpublished) with a per-PR job-level queue, plus a narrow actionlint ignore for the pre-queue parser error. The reviewer confirms the diagnosis and fix are correct, and the IPR workflow's own COMPLETED/SUCCESS run on this very PR empirically validates that GitHub accepts the queue: max syntax and publishes the required status.

Checked against the decision table:

• No critical/high findings (row 1 n/a).
• gated_paths is false — the REVIEW_REQUIRED status does not trigger row 2.
• high_risk is false; only workflow files touched (rows 3, 5 n/a).
• No medium findings at all (rows 4, 8 n/a).
• No no-auto-approve team match (row 7 n/a).
• No prior decision (row 6 n/a).

The cross-PR ledger-write race is author-acknowledged as a follow-up and fails visibly (git non-fast-forward push) rather than silently. Falls through to row 9 — approve.